Phishing over the phone: the tricks callers use
Quick answer
Phone phishing is a call or voicemail that pretends to be a bank, a government agency or a company to get your money or details. The tells are urgency, a demand for payment by gift card, wire, crypto or app, and a request for sensitive information. Hang up and call back on a number you look up.
- Comes by
- Phone call, Voicemail, Text
- Last updated
How it works
Scammers call, leave voicemails or send a text that pushes you to call back. The FTC lists the promises and threats they tend to use: you won a prize, you'll be arrested or fined unless you pay now, you must decide today, or there is a problem with your account.
They fake the caller ID. The FCC calls this spoofing: the number on your screen is falsified, sometimes to look like a local number (neighbor spoofing) or like a company or agency you already trust. If you answer, they run a script to get your money or personal information.
They also name real employees, quote badge or employee ID numbers, or say they are from an agency you know. The payment they ask for is the giveaway. Scammers insist on wire transfer, gift card, cryptocurrency or a payment app because those are hard to reverse.
Red flags
- Caller ID that matches a bank, agency or local number: it can be faked
- A threat of arrest, a fine or deportation unless you pay now
- You must pay by wire, gift card, crypto or payment app
- A request for a Social Security number or other sensitive information
- A prize you have to pay to collect
- Pressure to decide on the spot
- Robocalls or recorded messages that tell you to press a key
Example message
This is the fraud department. We have flagged unusual activity on your account. To protect your money, stay on the line and confirm your card number and the code we are about to text you, or call [phone number] right away.
What to do
- 1
Hang up
The FCC advises not to answer calls from unknown numbers, and to hang up straight away if you do. Don't press keys or speak to a recording.
- 2
Call back on a number you look up
Use the number on your card, statement or the company's own website, not the one the caller gave you.
- 3
Never share a code or a Social Security number
The FTC says no government agency will call out of the blue to ask for sensitive information like your Social Security number.
- 4
If you paid
Contact the company you paid with right away and ask for the payment to be reversed. If it was a gift card, call the card company.
- 5
If you shared personal details
Change the passwords involved and see IdentityTheft.gov. Our guide on what to do after a data breach has the steps.
- 6
Report the call
Report it to the FTC. If the number was spoofed, you can also file a complaint with the FCC.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers call people they already have a name and number for. Those details come from people-search sites, public records and data breaches, which is why a caller may greet you by name or know your town. Serus finds the data brokers and people-search sites that list your name, address and phone number and sends the removal requests, and it alerts you when your details show up in a breach, so fewer scammers can reach you.
Frequently asked
What is vishing?
It is phishing by phone: a call or voicemail that tries to get your money or personal details by pretending to be someone you trust.
Can caller ID be trusted?
No. The FCC says scammers deliberately falsify caller ID to look local or to look like a company or agency you know.
Will a government agency call me to threaten arrest?
The FTC says real law enforcement and federal agencies won't call and threaten you, and no agency will call to ask for your Social Security number.
What if I already paid?
Contact the company you used to send the money straight away and ask whether the payment can be reversed, then report it to the FTC.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
